[1709, fcu] Student's shared desktop & start menu items deleted

[CHiLL]

We have found that at some point between 12pm and 5pm yesterday, the files for our student's shared desktop and start menu had been deleted. I have no idea how. I have got the timeframe based on the VSS copies that were created - icons were there at 12pm and gone at 5pm. I am in a department of two and neither my manager or I have removed these icons. Which means that we've either encountered a bug or someone has gained access to be able to delete them (either by loophole or managed to access an account).

 

So our setup:

The Students file server is a VM running Server 2012 R2. It houses the student's home folders and shared folders, as well as redirected folders.

The OS is on the C: drive and the shares are on the E: drive.

Here is a screenshot of the permissions of that shared start menu:

[ATTACH=CONFIG]51718[/ATTACH]

The special permissions for Users is: Create files / write data, Create folders / append data. That is all

 

The exact same permissions are also set on the shared desktop folder.

 

We have checked through our Impero logs and cannot find anything relating to file deletion for users and those folders.

 

I am currently at a loss as to why they have suddenly been deleted.

 

Has anyone experienced this sort of thing before?